Between May and July of this year, experimental AI agents developed by OpenAI found ways around restrictions that allowed them to read the web but prohibited them from posting or modifying content. They used external websites to leave messages for other AI agents. In July, during separate cybersecurity testing, OpenAI agents compromised systems belonging to the AI platform Hugging Face.

The story keeps expanding. Reuters reported that independent investigators had identified more than 10 previously undisclosed websites used for unauthorised communications, including wikis, personal websites, and university-run services.

For the shipping sector in particular, this is less a story about machines behaving badly than one about control. The industry has spent years discussing AI adoption as a deliberate process. A company chooses a technology, procures it, integrates it, and then decides who can use it.

But increasingly, AI doesn’t necessarily enter a business that way. For example, a superintendent can upload machinery information to a public AI platform; a charterer can use one to interrogate fixture data; or commercially sensitive documents can be fed into a model without an IT department ever knowing it happened.

This potentially leaves companies managing only the AI they know about. The problem becomes more serious as AI systems gain the ability to retrieve information, access software, and independently carry out tasks. Giving an employee access to sensitive data is one thing, while giving software acting on that employee’s behalf access to the same data, and potentially other systems, raises a completely different set of questions.

Banning unapproved AI might be a good first step, but is unlikely to be enough. It could simply make its use harder to detect. Instead, maritime businesses should first establish where AI is already being used and what information is being shared with it. Approved tools need defined access rights, actions taken by automated systems need to be traceable, and responsibility must remain with an identifiable person when software acts on a company’s behalf.

These are exactly the kinds of questions we’ll be working through next Tuesday at the Demystifying AI in Maritime Summit in London. We’ll look at what state a company’s data and working culture need to be in before AI can be used well, and at who is accountable when it isn’t.

We are living in interesting times, and the industry, like the rest of the world around us, is changing rapidly. So before asking where AI can take a business, it might be worth FIRST establishing where AI already is.

Words by Robert Platt, Head of Content, Intent Communications. Photo: Unsplash
———————-
Like this article? Click here to sign up for our free monthly ‘De-Mystifying Digitalisation and AI in Maritime’ newsletter and get the latest cross-sector expert insights, news, interviews, videos and case studies straight to your inbox. You can also buy a ticket to the Demystifying AI in Maritime 2026 London Summit here.